#logstash

so it's transport?

or protocol?

I guess

or wire?

in terms of "where it came from"

like rabbitmq server foo.example.com exchange bar queue baz

I wonder

yeah - is that transport then?

no

yeah basically

sorta

yeah

I think I might table that until I have a 'tracer round' feature

be like "Show me the path this event took"

for real-time debugging or.. something

which would attach transport details to a trace field or something

good idea and add some docs now with "use add_field to do blah..."

+1

ok, sweeping the inputs now

ETOOMANYPLUGINS

somebody talking about logstash at pycon india it looks like

lots of twitter activity

yeah

The book has been selling well too

woot

pretty cool seeing a lgostash talk at pycon though

I submitted a talk to pycon 2 years ago on logstash and got rejected for logstash not being *written* in python

*sigh*

we had same for a puppet talk

ok so it wasn't just me, whew

alright off to sleep I think

anyone going to devopsdays vancouver?

let me know if you want help editing doc

jamesturnbull: g'night my aussie prince

s

jamesturnbull: will do, probably will send a PR up for feedback of the docs when I get to them

ok, so far, CMS is working *really* well

avleen: it should for logstash's workload

ES uses it too with good results

....

.... ?

my entire ES cluster just nullpointerexception'd

haha

what version?

all of the nodes, at the same time

neat!

0.90.3

lol

this is awesome!

FIRE THE BUGS

hmm

I think the gelf input has a concurrency bug

the gelf parser has like... no concept of which client is sending to it

maybe the message id is unique enough

can you use mutiple fields in the translate filter?

how so?

you want to translate multiple fields at once?

well the lookup having 2 tables

like field hostname and uniqueid

mapping to value x

instead of just uniqueid mapping to value x

I guess I could join hostname and uniqueid into another field

ooh

you want to use two fields as the lookup value?

like hostname.uniqueid ?

or something

yeah exactly

hmm

but I guess then the dictionary would also need 3 values

could make the lookup thing take a format string instead of a field name

so you coudl dsay

actually

what would the lookup return?

like if you looked up something on (hostname, uniqueid) (as a list)

you want to overwrite the hostname and uniqueid?

well in my case I want to add another field

put another way, how many values do you want to be returned by the lookup?

still just one?

1 per pair of fields yes

so translate(hostname, uniquid) == one value returned?

hmm, we could do that

yeah

that's supported now?

I mean could have code tod o it

doesn't work today I don't think

ohh

meh probably not worth it

eh, it'd be simple

I can probably work around it

translate { lookup => "%{hostname}.%{uniqueId}" destination => "somefield" }

does that seem ok? And then in your translation map you would have

somehostname.23456: somevalue

(or whatever)

yup

what I'm actually trying to do

is map iis W3SVC id's to the human readable names

but the W3SVC id's may not be unique across lots of servers

wonder if it's worth integrating heira somehow

hence why I'm trying to map against hostname.w3svcid to site_example

since that does all kinds of cool lookups

stonith: totally makes sense

but tbh not a huge deal for me… I can work around

stonith: making this feature available in the translate filter would be super easy

I could have it for you in logstash 1.2.1

(probably in a week or two)

tnx that'd be cool

but again, no rush

<3

btw, when is 1.2 being released?

probably tuesday

RC1 coming out tomorrow

looking forward to it

bed time :) night guys!

thanks for your help (again) :)

avleen: later!